[apparmor] [PATCH 1/2] apparmor: ensure WB_HISTORY_SIZE value is a power of 2

[John Johansen]

On 5/1/25 12:54, Ryan Lee wrote:
> WB_HISTORY_SIZE was defined to be a value not a power of 2, despite a
> comment in the declaration of struct match_workbuf stating it is and a
> modular arithmetic usage in the inc_wb_pos macro assuming that it is. Bump
> WB_HISTORY_SIZE's value up to 32 and add a BUILD_BUG_ON_NOT_POWER_OF_2
> line to ensure that any future changes to the value of WB_HISTORY_SIZE
> respect this requirement.
> 
> Fixes: 136db994852a ("apparmor: increase left match history buffer size")
> 
> Signed-off-by: Ryan Lee <ryan.lee at canonical.com>

Acked-by: John Johansen <john.johansen at canonical.com

> ---
>   security/apparmor/include/match.h | 3 ++-
>   security/apparmor/match.c         | 1 +
>   2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
> index 536ce3abd598..b45fc39fa837 100644
> --- a/security/apparmor/include/match.h
> +++ b/security/apparmor/include/match.h
> @@ -137,7 +137,8 @@ aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start,
>   
>   void aa_dfa_free_kref(struct kref *kref);
>   
> -#define WB_HISTORY_SIZE 24
> +/* This needs to be a power of 2 */
> +#define WB_HISTORY_SIZE 32
>   struct match_workbuf {
>   	unsigned int count;
>   	unsigned int pos;
> diff --git a/security/apparmor/match.c b/security/apparmor/match.c
> index 315fe74eac39..0172c06f6078 100644
> --- a/security/apparmor/match.c
> +++ b/security/apparmor/match.c
> @@ -682,6 +682,7 @@ aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start,
>   
>   #define inc_wb_pos(wb)						\
>   do {								\
> +	BUILD_BUG_ON_NOT_POWER_OF_2(WB_HISTORY_SIZE);			\
>   	wb->pos = (wb->pos + 1) & (WB_HISTORY_SIZE - 1);		\
>   	wb->len = (wb->len + 1) & (WB_HISTORY_SIZE - 1);		\
>   } while (0)